#!/usr/bin/python
# Copyright (c) PLUMgrid, Inc.
# Licensed under the Apache License, Version 2.0 (the "License")

from bcc import BPF



bfp_need_load = """
// 文件路径 到 read_write_class_id 的映射
#define NAME_MAX 255
struct filepath {
    char raw_str[256];  // 文件名最多长 255 加一个 截止符是256
};
BPF_HASH(path_to_read_write_class_id, struct filepath, int);

// 进程 PID 到 read_write_class_id 的映射
BPF_HASH(pid_to_read_write_class_id, int, int);

// read_write_class_id 到 owner_class_id 的映射
BPF_HASH(class_id_to_owner_class_id, int, int);

// read_write_class_id 到 class_ids_can_read_this 的映射
BPF_HASH(class_ids_can_read_this, int, int);
BPF_HASH_OF_MAPS(class_id_to_ids_can_read_this, int, "class_ids_can_read_this");

// read_write_class_id 到 class_ids_can_write_this 的映射
BPF_HASH(class_ids_can_write_this, int, int);
BPF_HASH_OF_MAPS(class_id_to_ids_can_write_this, int, "class_ids_can_write_this");



// file_write 挂载点
LSM_PROBE(file_permission, struct file *file)
{
    bpf_trace_printk("111file_read_check_start!\\n");
    // TODO
    return 0;
}


"""
BPF(text=bfp_need_load).trace_print()
